Abstract
In the second quarter of 2022, Utrecht University (UU) Research Data Management Support (RDM Support) sent out a survey among all scientific personnel at UU: the Data Privacy Survey. The aim of this survey was to investigate 1) How UU researchers currently deal with personal data in research, 2) What challenges they run into when handling personal data in research, and 3) How support at UU can improve their services concerning personal data in research. The results show that most researchers know to take into account privacy in their projects. However, there are vast differences in knowledge on this topic, as well as confusion on topics such as data sharing, anonymisation, and the administrative requirements surrounding privacy. Taken together, the survey shows that researchers could benefit from research support that is more visible in the organisation and more hands-on (i.e., advise that is immediately applicable instead of more general). Additionally, more awareness of the most important privacy-related topics, and how to deal with them in research seems desirable, both for newly employed and existing researchers. Finally, many researchers indicate to experience a high administrative burden that is partly caused by privacy-related documentation before starting a project. Finding a way to decrease this burden while still complying with legal and policy regulations will likely help to increase compliance and help researchers focus on performing high-quality research.
Scientific research often includes some form of personal data. The amount of personal data that is processed in research is likely underestimated, as researchers may be unaware of what personal data are or whether they are being collected. With the implementation of the General Data Protection Regulation (GDPR) in 2018, stricter legal requirements apply to handling personal data and its sharing and publication. In our own experience, the number and complexity of questions on handling personal data in scientific research at Utrecht University (UU) is increasing.
Our premise at Research Data Management Support (RDM Support) is to assist researchers with any issues surrounding the management of their research data, including research data that contains personal data. To understand how we can best help researchers with their privacy-related questions and needs, we wanted to investigate:
To answer these questions, we set up an online survey and planned one-on-one meetings with a selection of UU researchers. This report describes our methods, results and the future steps that data support at UU can take to improve their services concerning privacy in research.
This survey was part of a larger project at UU, the Data Privacy Project1. This project is a data support effort within UU that aims to provide actionable and FAIR (Findable, Accessible, Interoperable, Reusable) information and tools for researchers to handle personal data in their research.
The Data Privacy Survey was created by the project coordinators (DH, NM) with input from a wide variety of experts, consisting of privacy experts, data managers, data consultants, and IT staff (e.g., information security, research engineering). The survey consisted of 19-23 questions (the exact number differing depending on given answers), which were separated into 5 sections:
The estimated 10 minute duration of the survey in advance proved to be relatively accurate: respondents spent a median of 8.4 minutes on the survey (although there was a very large variation; range: 0.4 minutes - 5.1 days).
The survey was created in Qualtrics and distributed from March 21st, 2022 onwards via several communication channels to reach as many UU researchers as possible:
Researchers could decide voluntarily whether they wanted to participate in the survey. All results reported here are from researchers who provided their active consent, worked at Utrecht University and indicated to work with some type of research data.
The survey was filled out by 176 UU researchers. As can be seen in the figure below, we received responses from each UU faculty, but the distribution was not equal: the faculties of Science and Social and Behavioural Sciences were overrepresented, whereas the responses of the Faculty of Geosciences and the Faculty of Medicine were rather low. This can be explained by the mere size of the faculties (e.g., the faculty of Science is UU’s largest faculty), but also by the types of research performed there. For example, research performed at the faculty of Geosciences is largely involved with natural scientific data, rather than data from or relating to humans. The Faculty of Medicine, then, is located at the University Medical Center Utrecht (UMCU) and is not of primary interest for the current survey, which was sent to UU researchers only. A small selection of respondents indicated to work at another part of the organisation, being mainly University College Utrecht and the University Corporate Office.
Most of the survey respondents were relatively early career researchers (PhDs, junior researchers and postdoctoral researchers). We suspect that this is because 1) there simply are more people in these positions than there are in the others, and 2) early-career researchers may experience a greater need for support with respect to handling personal data.
There were 44 respondents from the Science faculty in the online survey. It took them a median of 5.7 minutes to complete it (ranging from 0.6 minutes to 5.1 days). In the graph below, the representation of each department within the Science faculty is visualised.
### FSBS There were 41 respondents from the Faculty of Social and
Behavioural Sciences (FSBS) in the online survey. It took them a median
of 8.9 minutes to complete it (ranging from 0.4 minutes to 0.3 days). In
the graph below, the representation of each department within FSBS is
visualised.
There were 27 respondents from the Faculty of Humanities in the online survey. It took them a median of 8.5 minutes to complete it (ranging from 0.9 minutes to 1.3 days). In the graph below, the representation of each department within the Faculty of Humanities is visualised.
There were 23 respondents from the Faculty of Veterinary Medicine in the online survey. It took them a median of 10.4 minutes to complete it (ranging from 1.4 minutes to 0.2 days). In the graph below, the representation of each department within the Faculty of Veterinary Medicine is visualised.
### LEG There were 21 respondents from the Faculty of Law, Economics,
and Governance (LEG) in the online survey. It took them a median of 10.1
minutes to complete it (ranging from 3.5 minutes to 0.9 days). In the
graph below, the representation of each department within the Faculty of
Law, Economics, and Governance (LEG) is visualised.
There were 27 respondents from the Faculty of Geosciences in the online survey. It took them a median of 7.1 minutes to complete it (ranging from 2.9 minutes to 0 days). In the graph below, the representation of each department within the Faculty of Geosciences is visualised.
Besides the online survey, we organised one-on-one meetings with researchers, to hear about their personal experiences, challenges and needs concerning the handling of personal data in their research. Survey respondents could voluntarily leave their email address at the end of the survey to be contacted by us. These meetings were semi-structured and revolved around the following questions:
All of the one-on-one meetings were conducted online and took approximately 30 minutes. During the meetings, one of the project coordinators (DH) was always present, together with either the other project coordinator (NM) or the relevant faculty privacy officer. Before the privacy officer was invited to the meeting, the researcher’s consent to do so was always obtained first.
From the survey respondents, 40 researchers left their email address to be contacted. Of those, 28 researchers indicated that they were willing to meet with us. Below, the division over faculties can be seen for all interviewees. Notably, the distribution seemed to mirror the faculty distribution in the entire survey relatively well.
From the survey respondents, 7 researchers from the Science faculty left their email address to be contacted, although not all researchers indicated to be willing to meet with us when contacted. So far, 7 online meetings have been conducted, each with the project coordinators. Below, the division over positions can be seen for all interviewees from the Science faculty.
From the survey respondents, 9 researchers from the faculty of Social and Behavioural Sciences (FSBS) left their email address to be contacted, although not all researchers indicated to be willing to meet with us when contacted. So far, 6 online meetings have been conducted, most of them with a privacy officer present. Below, the division over positions can be seen for all interviewees from the faculty of Social and Behavioural Sciences (FSBS).
From the survey respondents, 7 researchers from the Humanities faculty left their email address to be contacted, although not all researchers indicated to be willing to meet with us when contacted. So far, 5 online meetings have been conducted, all of them with a privacy officer present. Below, the division over positions can be seen for all interviewees from the Humanities faculty.
From the survey respondents, 7 researchers from the faculty of Veterinary Medicine left their email address to be contacted, although not all researchers indicated to be willing to meet with us when contacted. So far, 5 online meetings have been conducted, most of them with a privacy officer present. Below, the division over positions can be seen for all interviewees from the faculty of Veterinary Medicine.
From the survey respondents, 7 researchers from the faculty of Law, Economics, and Governance (LEG) left their email address to be contacted, although not all researchers indicated to be willing to meet with us when contacted. So far, 2 online meetings have been conducted, most of them with a privacy officer present. Below, the division over positions can be seen for all interviewees from the faculty of Law, Economics, and Governance (LEG).
From the survey respondents, 1 researchers from the Geosciences faculty left their email address to be contacted, although not all researchers indicated to be willing to meet with us when contacted. So far, 1 online meetings have been conducted. Below, the division over positions can be seen for all interviewees from the Geosciences faculty.
From the raw Qualtrics output, we first cleaned and split the data into different data files (cleaned and closed survey responses, open text responses, email addresses, see the pseudonymise-data.R script for details). Both the open text responses and the notes made during the one-on-one meetings were separately and manually scored to enable the extraction of action points.
Below we report on the descriptive statistics or summaries from most of the survey questions. As we did not formulate hypotheses, no statistical analyses were performed.
All survey-related documentation can be found in the dedicated survey repository. It contains:
As the dataset contains personal information (demographic information, open text responses, email addresses, etc.), and no consent was obtained to share those details, we are unable to share them in this repository.
To investigate the types of research that was represented in the sample, we asked which types of data, and specifically which types of personal data the respondents worked with. Most respondents indicated to use tabular, textual, code and audio data as their primary research data format. In terms of personal data types, contact information, demographic information and direct identifiers were most common among the respondents. This can be either because these are the types of personal data that are indeed most common, but possibly also because researchers mostly recognise these types of data as being personal data.
|
|
When comparing faculties, it appears that most personal data is processed in the faculties of Social and Behavioural Sciences (FSBS), although the faculties of Science and Veterinary Medicine also seem to process quite some personal data. In the tabs, we look further into the types of (personal) data processed within each faculty.
As with the university-wide data, researchers from the Science faculty indicated that they also most often used tabular data, textual data and code/theoretical models in their research. The same goes for the types of personal data: the same top-3 types are used here as in the entire university (demographic information, contact information, direct identifiers).
|
|
As a large part of the researchers from the Science faculty indicated not to use any personal data whatsoever in their research, it may be useful to investigate in which departments these researchers work. In the figure below, the division of personal data types per Science department is plotted. As can be expected, the departments of Biology, Physics and Mathematics do not seem to process much personal data, whereas in the Information and Computing Sciences and Pharmaceutical Sciences departments, the most personal data is processed. This makes sense considering the types of research performed in these departments.
As with the university-wide data, researchers from the faculty of Social and Behavioural Sciences (FSBS) indicated that they also most often used tabular data, textual data and code/theoretical models in their research. The same goes for the types of personal data: demographic and contact information are most often used. Interestingly, sensitive demographic information is used much more relative to the UU-wide responses.
|
|
When comparing the types of personal data across departments of the faculty, the departments of Sociology and Cultural Anthropology seem to process the least amount of personal data - although these departments may also simply be underrepresented in the survey sample. Most other departments process quite some personal data, as can be expected from a faculty of which the research focuses almost exclusively on humans.
As with the university-wide data, researchers from the faculty of Humanities indicated that they also most frequently used tabular data, textual data and audio data in their research. The same goes for the types of personal data: the same top-3 types are present here as in the entire university (demographic information, contact information, direct identifiers).
|
|
If we look at the different departments within the faculty, it is clear that mostly the departments of Languages, Literature and Communication, and of Media and Culture Studies process personal data in their research. Especially researchers at the department of Languages, Literature and Communication seem to process a lot of personal data, which makes sense considering the type of research performed there.
When comparing the types of data that researchers at the Faculty of Veterinary Medicine work with, it is clear that researchers at this faculty work with slightly different types of data, i.e. biological and physiological data are more common among these researchers. Despite this, the most frequent types of personal data do correspond well to the university-wide numbers: demographic information, direct identifiers and contact information are also the most common types of personal data researchers at this faculty seem to deal with.
|
|
When looking at each department separately, it is clear that researchers in the department of Population Health Sciences process the large majority of the personal data within the faculty. Of course, it may also be possible that this department was simply more represented in the survey than the other departments.
As with the university-wide data, researchers from the faculty of Law, Economics and Governance (LEG) indicated that they also most frequently used tabular data, textual data and audio data in their research. The same goes for the types of personal data: the same top-3 types are present here as in the entire university (demographic information, contact information, direct identifiers).
|
|
When looking at the different departments within the faculty, researchers in the department of Governance seem to process personal data the most often, followed by the department of Law. Of course, it is possible that the other departments process more personal data than the respondents indicated.
As with the university-wide data, researchers from the faculty of Geosciences indicated that they also most frequently used textual and tabular data. However, in contrast to the university-wide data, they are followed by geographical data and code/theoretical models. This is to be expected considering the faculty. In terms of personal data, however, the same top-3 types are present here as in the entire university (demographic information, contact information, direct identifiers).
|
|
When comparing departments, it becomes immediately clear that most personal data seems to be processed in the department of Sustainable Development, and some also in the Human Geography and Spatial Planning department. This makes sense, as the research performed at the third department (Earth sciences) usually does not focus on human behaviour and thus does not involve much personal data, if any.
The first part of the survey addressed the researchers’ current practices in handling personal data in their research.
With respect to organisational and technical measures used to handle personal data, most respondents indicated that they pseudonymise/anonymise their data. As this question is self-reported, we cannot assess whether the researchers’ data was actually sufficiently pseudonymised/anonymised in line with the GDPR. Secondly, many researchers seemed to implement access control and encryption, and complete a Data Management Plan (DMP) during their project(s). This is to be expected, as most funders nowadays require a DMP and many DMP templates explicitly address topics like pseudonymisation, access control and encryption. On the other hand, GDPR-specific assessments such as Data Protection Impact Assessments (DPIAs) or privacy reviews were least used - as it stands, these assessments are still only carried out on a case-by-case basis.
Protective measures for Science faculty
Protective measures for the Faculty of Social and Behavioural Sciences (FSBS)
Protective measures for the Faculty of Humanities.
Protective measures for the Faculty of Veterinary Medicine.
Protective measures for the Faculty of Law, Economics and Governance.
Protective measures for the Faculty of Geosciences.
When working with personal data, it is important to choose a sufficiently secure storage medium. Luckily, most respondents indicated to rely on storage solutions that are provided or recommended by UU - and in most cases are indeed safe for storing personal data. Nonetheless, some respondents indicated to use non-UU solutions, including cloud solutions that UU advises against using. Several respondents also indicated that they use other storage solutions, such as those of external institutions (e.g., University Medical Center, Trimbos Institute, Central Bureau of Statistics) and repositories (e.g., DANS EASY, CLARIAH).
Storage media used in the Science faculty.
Storage media used in the Faculty of Social and Behavioural Sciences.
Storage media used in the Faculty of Humanities.
Storage media used in the Faculty of Veterinary Medicine.
Storage media used in the Faculty of Law, Economics and Governance.
Storage media used in the Faculty of Geosciences.
Consent is currently the legal basis most often used in researcher performed at UU. Luckily, only a small number of respondents indicated that consent forms are not applicable to their research or they don’t know what they are. The consent forms most often used seem to be approved by privacy officers or ethical committees. Some respondents however indicated to independently create and use consent forms. A handful of respondents indicated to use templates from external institutions, or no templates at all (e.g., because they use verbal consent or data from another party).
The mere fact that researchers make use of a consent form and information letter of course does not mean these forms are of sufficient quality. Therefore, we asked respondents what they typically include in their information to participants. Most respondents indicated to provide at least the basic information on the purposes for data collection and which data will be be used. Information on the data subjects’ rights and safeguards are often included as well.
Information and consent on data sharing and reuse is apparently not included as often. This is a point of concern, because not obtaining consent for sharing personal data for reuse may mean that data collected for a specific research project may not be reused again, reducing the scientific value of the data.
Finally, contact details of the Data Protection Officer (DPO) are not always included either, whereas these always have to be provided when working with personal data (art. 13)
Below the usage and content of informed consent forms at the Science faculty is displayed.
Below the usage and content of informed consent forms at the Faculty of Social and Behavioural Sciences (FSBS) is displayed.
Below the usage and content of informed consent forms at the Faculty of Humanities is displayed.
Below the usage and content of informed consent forms at the Faculty of Veterinary Medicine is displayed.
Below the usage and content of informed consent forms at the Faculty of Law, Economics and Governance is displayed.
Below the usage and content of informed consent forms at the Faculty of Geosciences is displayed.
A Data Protection Impact Assessment (DPIA) is a legal instrument to assess the risks involved for data subjects, and helps determine the necessary safeguards to reduce those risks to an acceptable level. Despite it being an important legal instrument, most respondents indicated to never have carried one out, or heard of it, for that matter. A minority of the sample had heard of it, or has completed one. Currrently, the desired scenario is that researchers get help from a privacy officer when performing a DPIA, and the results seem to indicate that this is indeed the case in the majority of cases.
Below the experience and help received with DPIAs is displayed for the Faculty of Science.
Below the experience and help received with DPIAs is displayed for the Faculty of Social and Behavioural Sciences (FSBS).
Below the experience and help received with DPIAs is displayed for the Faculty of Humanities.
Below the experience and help received with DPIAs is displayed for the Faculty of Veterinary Medicine.
Below the experience and help received with DPIAs is displayed for the Faculty of Law, Economics and Governance.
Below the experience and help received with DPIAs is displayed for the Faculty of Geosciences.
To investigate how often data are being shared and under which circumstances, we asked respondents if and with which parties they typically share their research data, and which measures they usually take to do so securely. While there were some respondents who indicated not to share their data at all, most respondents seem to only share research data within the organisation, and otherwise within the European Economic Area (EEA). This is relatively good news, as such transfers usually require little, if any, additional safeguards. Responses in the “Other” category, however, suggest that a lot of data actually are shared, for example with co-authors at another institution, students, or in “pseudonymised form”.
Concerning the measures used before sharing data, most repondents indicated to pseudonymise their data, though we cannot assess the quality of such pseudonymisation. Researchers also seemed to use approved tools, agreements, and providing access without data transfer. Only a few respondents indicated that they involved a data expert while transferring data, and the use of Standard Contractual Clauses appears limited.
Below the data sharing practices across the Faculty of Science are visualised.
Below the data sharing practices across the Faculty of Social and Behavioural Sciences (FSBS) are visualised.
Below the data sharing practices across the Faculty of Humanities are visualised.
Below the data sharing practices across the Faculty of Veterinary Sciences are visualised.
Below the data sharing practices across the Faculty of Law, Economics and Governance are visualised.
Below the data sharing practices across the Faculty of Geosciences are visualised.
Open science and privacy are often seen as conflicting, as sharing personal data cannot be done just like that, but requires at the very least a valid legal basis and additional safeguards. Therefore, in our experience, to date not many datasets that contain personal data are shared for reuse purposes, and the survey respondents seemed to confirm this experience, as the majority of the respondents indicated not to publish their data, or only in anonymised form (again, we cannot be certain whether the data were indeed entirely anonymised).
The primary reason for not publishing data appears to be that researchers were still working on the data, they don’t want to/need to publish their data, or they cannot anonymise the data. Other reasons given by the respondents included that publishing data is too much effort, publication is undesirable, or just not considered.
For the Faculty of Science, no respondents indicated to publish datasets, only metadata if applicable. Therefore, there were no respondents who filled out the question about the data format in which the data were published.
Below you can see for the Faculty of Social and Behavioural Sciences (FSBS) in which format they publish their data, if they do (left), or which reasons researchers indicated to have to not publish data.
Below you can see for the Faculty of Humanities in which format they publish their data, if they do (left), or which reasons researchers indicated to have to not publish data.
For the Faculty of Veterinary Medicine, no respondents indicated to publish datasets, only metadata if applicable. Therefore, there were no respondents who filled out the question about the data format in which the data were published.
Below you can see for the Faculty of Law, Economics and Governance in which format they publish their data, if they do (left), or which reasons researchers indicated to have to not publish data.
For the Faculty of Geosciences, no respondents indicated to publish datasets, only metadata if applicable. Therefore, there were no respondents who filled out the question about the data format in which the data were published.
The second part of the survey concerned the visibility and use of existing support channels.
When asked whether respondents know who their faculty privacy officer is, a little over half of the respondents indicated that they do not (Yes: 64 (48%), No: 69 (52%)).
When comparing faculties (see below), it is striking that the faculties where the most personal data seems to be processed, a small majority of respondents is not aware of their faculty privacy officer. This suggests either that researchers have simply never required help from their privacy officer, or that the faculty privacy officers could increase their visibility within their faculties.
When asked whether respondents have ever looked for support in the form of information, tools, or in-person support, an overwhelming majority indicated that they have, as can be seen in the graph below. Most respondents that looked for support indicated, however, that they haven’t always found the support they were looking for. Together with the results from the previous question, this suggests that the visibility of the current support channels could be improved. Note however that there are some differences between faculties (see the different tabs).
Below are the results for the Faculty of Science when asked whether researchers had looked for information, support or tools in handling personal data, and whether they had found what they were looking for:
Below are the results for the Faculty of Social and Behavioural Sciences (FSBS) when asked whether researchers had looked for information, support or tools in handling personal data, and whether they had found what they were looking for:
Below are the results for the Faculty of Humanities when asked whether researchers had looked for information, support or tools in handling personal data, and whether they had found what they were looking for:
Below are the results for the Faculty of Veterinary Medicine when asked whether researchers had looked for information, support or tools in handling personal data, and whether they had found what they were looking for:
Below are the results for the Faculty of Law, Economics and Governance (LEG) when asked whether researchers had looked for information, support or tools in handling personal data, and whether they had found what they were looking for:
Below are the results for the Faculty of Geosciences when asked whether researchers had looked for information, support or tools in handling personal data, and whether they had found what they were looking for:
The graph below indicates which channels respondents used most when looking for information about handling personal data. As shown below, all sources mentioned were to some extent consulted by the respondents. However, there is large differentiation between these sources. The university website and intranet are the most visited online resources for information about handling personal data. Notably, colleagues appear to play an important role as well in informing researchers about how to handle personal data. This suggests that the better informed researchers are, the more positive the effect is on their colleagues as well. Moreover, this also suggests that in-person support may be a more effective way of increasing awareness of privacy-related practices than more “distant” information sources.
Below you can find the channels used by researchers from the Faculty of Science to find information about handling personal data:
Below you can find the channels used by researchers from the Faculty of Social and Behavioural Sciences (FSBS) to find information about handling personal data:
Below you can find the channels used by researchers from the Faculty of Humanities to find information about handling personal data:
Below you can find the channels used by researchers from the Faculty of Veterinary Medicine to find information about handling personal data:
Below you can find the channels used by researchers from the Faculty of Law, Economics and Governance (LEG) to find information about handling personal data:
Below you can find the channels used by researchers from the Faculty of Geosciences to find information about handling personal data:
As can be seen above, most researchers experience privacy to be an obstacle for open science and research data management in some way. It is therefore important to aim for support in this area. What this support should look like, however, differs a bit. As can be seen below, accessible information and visible support channels seem to be the most wanted improvements in the current support, closely followed by UU-wide policy on the topic, and privacy-related walk-in hours.
Below you can find the preferred ways of improving privacy-related support as indicated by researchers from the Faculty of Science:
Below you can find the preferred ways of improving privacy-related support as indicated by researchers from the Faculty of Social and Behavioural Sciences (FSBS):
Below you can find the preferred ways of improving privacy-related support as indicated by researchers from the Faculty of Humanities:
Below you can find the preferred ways of improving privacy-related support as indicated by researchers from the Faculty of Veterinary Medicine:
Below you can find the preferred ways of improving privacy-related support as indicated by researchers from the Faculty of Law, Economics and Governance (LEG):
Below you can find the preferred ways of improving privacy-related support as indicated by researchers from the Faculty of Geosciences:
As mentioned in the Methods section, the responses on the following open questions, and the notes taken during the one-on-one meetings with researchers were coded to allow for easier analysis. From the survey, the following questions were coded:
The codes that were assigned in both the survey and the meeting notes can be seen in the word cloud below: the larger the font, the more often the code was assigned. The meaning of each code is explained in the file “codes-freq_survey_meetings.csv” and below. Please note that there is overlap in respondents between the open questions in the survey and the meeting notes, and therefore some codes may have been applied twice for the same researcher.
Here are results per faculty
dasd
asasd
adasds
asasd
asd
Below we go into the most frequently mentioned challenges/needs expressed by researchers in the survey (open questions) and one-one-one meetings:
It should be clear where to go for help (to whom or which webpage, etc.) (mentioned 27 times). Some respondents indicated not to know where to go for help with privacy-related matters, others mentioned that there should be more support personnel available (8). One researcher said to prefer having one place to go to for all data-related questions. As a matter of fact, many faculties have such a “one-stop-shop” in place, but responses such as these indicate that their visibility may be improved.
Closely related to visibility is findability. Many researchers point out that available information is difficult to find, or it is confusing which source should be followed. As an example, one researcher from the faculty of Humanities was determined that they found some useful information at the RDM Support website. However, upon closer inspection, it appeared that this information arose from another data management-related website with the UU logo on it.
“UU biedt ontzettend veel aan, maar je moet veel websites bezoeken om alles te vinden […] Een duidelijk overzicht voor welke informatie je waar moet zijn zou fijn zijn.”
Some (26) researchers expressed a need for a concrete (improvement of a) tool, such as for:
times) - (mentioned
times) - (mentioned
times)
Many (24) researchers indicated that support staff could sometimes provide support in a more hands-on fashion, rather than abstract advice and telling researchers how not to do things. Some researchers added that privacy professionals sometimes have a tendency to cling to the letter of the law, leading to significant delays in their project, instead of looking at how to concretely solve existing issues in practice (mentioned 11 times):
“Soms zijn we door deze regels heiliger dan de paus.”
“Actual getting-your-hands-dirty support: not the kind that tells you what to do, but also the kind that helps you by doing.”
Processes were often experienced as time-inefficient, and sometimes longer and more bureaucratic than necessary (mentioned by 22 researchers). For example, the DPIA process was mentioned explicitly (10 times), as well as having to fill out too many forms with overlapping content (e.g., Privacy Scan, Data Management Plan, DPIA). Some (9) researchers argued that (part of) this burden should be relieved or carried by support staff:
“Minder acties die gericht zijn op inhoudelijk trainen van WP en meer uit handen nemen van deze groep.”
“Sharing data costs a lot of time and is inefficient when you do not do it often”
Many (18) researchers complained that it was unclear what was expected of them when they processed personal data in their research, or that they would like to have more, or more practical guidelines (14) on this topic, for example on:
A large part of the respondents expressed a need for more (clear) information and education with respect to handling personal data in research. In general, researchers indicated that the information offered to them should be more clear (3), simpler 9, consistent across resources (8), possibly in the form of templates (14). Luckily, some researchers indicated to already be happy with existing materials (4).
Many researchers indicated to have a need for more tailored information for specific types of data or research (9), for example for etnographic data (2), historical data (2), or video data (3).
“De informatie is gewoon veel te generiek, er zouden templates moeten zijn per type onderzoek.”
“Veel templates en uitlegmodellen spreken over data, data packages en metadata, maar die woorden zijn niet ingebed in historisch onderzoek. Er ontstaat al snel verwarring over wat historici nu precies moeten met archiefmateriaal in het licht van privacy.”
A selection of researchers used the space in the open questions and/or the meetings to ask knowledge-related questions. These can be used in future support efforts, such as the Data Privacy Handbook, future courses, or other future information campaigns to better address researchers’ needs. Below are examples of the most commonly asked questions:
The need for more educational resources was also recognised by a selection of the respondents. Concretely, researchers could be educated more in the following ways:
“There is no one who tells at the start of your PhD how you should handle your data. […] I think new PhD students should get a basic course on data management and privacy.”
Notably, there were also researchers who indicated not to have run into issues (yet), or to have received sufficient and useful help (9). For example:
“The data manager and privacy officer of the faculty of humanities help a lot. This support is essential!”
“Tot nu toe heb ik niet veel problemen gehad. De institutional review board van onze afdeling kijkt altijd kritisch naar de onderzoeksvoorstellen, ook met name op omgaan met persoonsgegevens.”
This document was last created on: 2022-09-27. It was created in the following environment:
## R version 4.2.0 (2022-04-22 ucrt)
## Platform: x86_64-w64-mingw32/x64 (64-bit)
## Running under: Windows 10 x64 (build 19042)
##
## Matrix products: default
##
## locale:
## [1] LC_COLLATE=Dutch_Netherlands.utf8 LC_CTYPE=Dutch_Netherlands.utf8
## [3] LC_MONETARY=Dutch_Netherlands.utf8 LC_NUMERIC=C
## [5] LC_TIME=Dutch_Netherlands.utf8
##
## attached base packages:
## [1] stats graphics grDevices utils datasets methods base
##
## other attached packages:
## [1] wordcloud2_0.2.1 readxl_1.4.1 kableExtra_1.3.4 knitr_1.39
## [5] gridExtra_2.3 forcats_0.5.1 stringr_1.4.0 dplyr_1.0.9
## [9] purrr_0.3.4 readr_2.1.2 tidyr_1.2.0 tibble_3.1.8
## [13] ggplot2_3.3.6 tidyverse_1.3.2 data.table_1.14.2
##
## loaded via a namespace (and not attached):
## [1] svglite_2.1.0 lubridate_1.8.0 assertthat_0.2.1
## [4] digest_0.6.29 utf8_1.2.2 R6_2.5.1
## [7] cellranger_1.1.0 backports_1.4.1 reprex_2.0.2
## [10] evaluate_0.16 highr_0.9 httr_1.4.4
## [13] pillar_1.8.0 rlang_1.0.4 googlesheets4_1.0.1
## [16] rstudioapi_0.13 jquerylib_0.1.4 rmarkdown_2.15
## [19] labeling_0.4.2 webshot_0.5.3 googledrive_2.0.0
## [22] htmlwidgets_1.5.4 munsell_0.5.0 broom_1.0.0
## [25] compiler_4.2.0 modelr_0.1.8 xfun_0.32
## [28] systemfonts_1.0.4 pkgconfig_2.0.3 htmltools_0.5.3
## [31] tidyselect_1.1.2 viridisLite_0.4.0 fansi_1.0.3
## [34] crayon_1.5.1 tzdb_0.3.0 dbplyr_2.2.1
## [37] withr_2.5.0 grid_4.2.0 jsonlite_1.8.0
## [40] gtable_0.3.0 lifecycle_1.0.1 DBI_1.1.3
## [43] magrittr_2.0.3 scales_1.2.0 cli_3.3.0
## [46] stringi_1.7.8 cachem_1.0.6 farver_2.1.1
## [49] fs_1.5.2 xml2_1.3.3 bslib_0.4.0
## [52] ellipsis_0.3.2 generics_0.1.3 vctrs_0.4.1
## [55] tools_4.2.0 glue_1.6.2 hms_1.1.1
## [58] fastmap_1.1.0 yaml_2.3.5 colorspace_2.0-3
## [61] gargle_1.2.0 rvest_1.0.2 haven_2.5.0
## [64] sass_0.4.2
The Data Privacy Project is funded by Utrecht University’s Research IT program and a Digital Competence Center grant from the Dutch Organization for Scientific Research (NWO). It is led by Utrecht University’s Research Data Management Support, in collaboration with the University Library, Information Technology Services, first- and second-line privacy officers, information security, and others.↩︎